4 posts filed under security.
The mongreldb-php client validates every permission string against a strict allowlist before it builds a GRANT statement, because DDL fragments cannot be bound as parameters and the classic prepared-statement advice does not cover them.
The MongrelDB PHP client mirrors the daemon's two auth modes with one constructor argument each, and anything more exotic, from per-request token vending to signing proxies, goes behind a one-method TransportInterface you control.
Most database auth lives in middleware, which means every code path that skips the middleware skips the auth. MongrelDB stores Argon2id-hashed users and roles in the catalog and can enforce permissions on every transaction at the storage layer itself.
SQLite SEE is the official paid reference for SQLite encryption. Here is MongrelDB's open-source AES-GCM design, key hierarchy, WAL coverage, and search tradeoff.
